1---2title: NIP-AD web addresses3audience: user4---56# NIP-AD web addresses78A relay or site URL works in a browser and resolves to a Nostr event in9clients that support NIP-AD. bind.ws follows [proposal 2406](https://github.com/nostr-protocol/nips/pull/2406),10[`AD.md` at b82a9bf66ec9757149b5aa3b3cd36190dd4e6fed](https://github.com/nostr-protocol/nips/blob/b82a9bf66ec9757149b5aa3b3cd36190dd4e6fed/AD.md),11checked 2026-09-04. The proposed text labels itself `final` and `optional`,12but the pull request is still a proposal. Its wire format may change.1314## Resolve a URL1516A supporting client takes the URL's pathname and requests17`https://<host>/.well-known/nostr.json?path=<encoded-pathname>`. Encode the18pathname as a query parameter, preserving any escapes already in the URL:19`/a/hello%20world` becomes `path=%2Fa%2Fhello%2520world`.2021For `https://alice.bind.ws/a/why-relays`, the response has this shape:2223```json24{25 "/a/why-relays": {26 "filter": {27 "kinds": [30023],28 "authors": ["<owner-pubkey>"],29 "#d": ["why-relays"],30 "limit": 131 },32 "relays": ["wss://alice.bind.ws"]33 }34}35```3637The client queries the named relay with that filter. A browser opening the38original URL continues to receive the existing page. Notes and articles39also have an "Open in a nostr client" link.4041| Browser URL | Nostr counterpart |42|---|---|43| Relay `/` | Relay-signed kind 39000, with the relay identity and group identifier |44| Relay `/e/<id>` | That exact note or article event ID, including its version |45| Relay `/a/<d>` | Owner's current kind 30023 article with that identifier |46| Relay `/a/<author>/<d>` | That author's current article; hex, npub and nprofile authors follow the browser page parser |47| Site `/`, a mapped file or directory | Current kind 15128 or 35128 manifest, or exact kind 5128 snapshot |4849All filters include `limit: 1` and explicit relay hints. Address filters50include the full author, kind and, for addressable events, `#d`. Event ID51filters use the full ID. Site hints name the relay holding the manifest,52not the site hostname. Custom domains follow their selected relay or site;53local development retains `ws://` and its port.5455## Visibility and errors5657Discovery applies the target's existing access rules:5859| Target | Rule |60|---|---|61| Relay group | Current read rule; private metadata requires an admitted NIP-98 identity |62| Note or article | Open reads and the `pages` feature; signing does not open private pages |63| Site manifest | `sites` feature, site authentication and the current read rule |64| Removed, expired or moderation-hidden event | No mapping |65| Unclaimed or expired relay | No mapping |6667Successful lookups return only the requested path. Unknown paths return68`{}`; discovery does not return the member directory or enumerate paths.69Site paths must appear in the live manifest, directly or as a directory's70`index.html`. A `/404.html` fallback does not give a missing path a mapping.71Discovery reads manifest metadata without fetching or verifying file bytes;72the normal site request still verifies and serves the file.7374Private group and site requests return 401 without authentication or 40375for a proved identity the read rule excludes. Site visitors retain the76existing sign-in flow and host-only cookie; API clients can sign the exact77discovery URL with NIP-98. Site-origin discovery never exposes the hosting78relay's NIP-05 names, console, WebSocket, event pages or management methods.79Blocked IP addresses remain blocked.8081GET returns JSON, HEAD returns the same status and headers without a body,82and OPTIONS supports discovery preflight without resolving a path.83Discovery responses use CORS and84`Cache-Control: private, no-store` so policy changes are checked each time.85Unsupported methods return 405. Invalid GET or HEAD paths return 400: only one absolute86pathname of at most 4096 characters is accepted, without literal queries,87fragments, whitespace, control characters, backslashes or dot segments.88Percent-encoded spaces and other article identifier characters work when89the pathname is correctly query-encoded. Full URLs are not accepted and90discovery never fetches an external URL.9192## Names and capabilities9394The existing NIP-05 endpoint keeps its behavior. With `name`, including a95request that also has `path`, it answers the name lookup. Without either96parameter it answers the permitted member directory. Turning off `names`97disables those NIP-05 responses; path discovery remains available. Turning98off `pages` or `sites` removes their respective mappings.99100This implementation leaves the NIP-11 `supported_nips` representation101unchanged. Lettered capability advertisement is coordinated separately102with NIP-9a and NIP-5A compatibility work.